In pattern matching (or string matching), a processor determines whether a data stream or a portion of a data stream matches one or more predefined patterns. That data stream may be data entering a computer node from a remote computer node. For example, the predefined patterns may be virus patterns or other undesirable codes present in the data stream.
Pattern matching is also useful in inspecting and classifying packets sent over a network. For example, a network firewall or an intrusion detection system may inspect packets for computer virus patterns and appropriately filter such packets. A server load balancer may compare text within the packets to a list of Universal Resource Locator (URL) addresses, then classify and redirect the packets to specific servers based on the URLs. Such classification of packets requires comparison of the packets with a set of predefined patterns.
A method of inspecting the packets is by performing a “brute force” approach, which compares the packets with an entire set of predefined patterns. The computation time of this method increases in proportion to the amount of incoming data and the number of patterns.